Leaked Files Reveal Scope of Cellebrite's Smartphone-Cracking Technology (zdnet.com) 37
An anonymous reader quotes a report from ZDNet: Earlier this year, we were sent a series of large, encrypted files purportedly belonging to a U.S. police department as a result of a leak at a law firm, which was insecurely synchronizing its backup systems across the internet without a password. Among the files was a series of phone dumps created by the police department with specialist equipment, which was created by Cellebrite, an Israeli firm that provides phone-cracking technology. We obtained a number of these so-called extraction reports. One of the more interesting reports by far was from an iPhone 5 running iOS 8. The phone's owner didn't use a passcode, meaning the phone was entirely unencrypted. The phone was plugged into a Cellebrite UFED device, which in this case was a dedicated computer in the police department. The police officer carried out a logical extraction, which downloads what's in the phone's memory at the time. (Motherboard has more on how Cellebrite's extraction process works.) In some cases, it also contained data the user had recently deleted. To our knowledge, there are a few sample reports out there floating on the web, but it's rare to see a real-world example of how much data can be siphoned off from a fairly modern device. We're publishing some snippets from the report, with sensitive or identifiable information redacted.
Apple and Google get ALL that data (Score:1, Insightful)
And you agreed to give it to them.
"Don't be evil" my ass.
If you have a smart phone, any complaints you make about "warrantless wiretaps" or "massive government surveillance" are complaints about getting rained on while you're drowning in the ocean.
Re: (Score:2)
Re: (Score:1)
Google and Apple are only in it for the money. The worst they can do is sell the data they collected. Governments have almost limitless power and can combine data they grabbed from various sources.
Re: (Score:1)
Google and Apple are only in it for the money. The worst they can do is sell the data they collected. Governments have almost limitless power and can combine data they grabbed from various sources.
And they turn around and sell that data to anyone who meets their price. So Google and Apple are doing government dirty work for money.
How much more evil can they be?
Re: Apple and Google get ALL that data (Score:1)
What the hell are these comments about?
What does this have to do with Google at all or Apple being evil?
There's nothing about companies selling your data.
Also owner of the phone didn't encrypt the data so it's open to anyone with possession of the phone. It's not apple's fault.
And like what the hell does Google got to do with this?
Re: (Score:1)
This. (the whole tread was insane!)
Re:Apple and Google get ALL that data (Score:4, Insightful)
Re: (Score:3)
Re: (Score:1)
Re: (Score:1)
The key difference between Apple and Google is that Apple is working hard to make sure that it doesn't have the data to give to government authorities when they're asked. They're busy end-to-end encrypting things, and keeping data local to devices, rather than uploading it to their servers.
The court case they fought was not about handing over data (because trying to fight that is a losing battle), it was about being forced to roll back their attempts to not have any data to give.
I always remind this sentence... (Score:3)
Re: (Score:2)
Re: I always remind this sentence... (Score:1)
Well duh, he'd be 200+ years old, very suspicious. He also has a problem with getting women drunk and raping them.
Re: (Score:2)
Re: (Score:2)
So what you're saying is we should put Trump on the $100 bill?
Re: (Score:1)
Probably not, but as a ponytailed uberhacker he would be getting more than his fair share of NSA surveillance and he would probably be pulled aside in airport security often. Think Moxie Marlinspike, Nadim Kobeissi etc.
Re: (Score:2)
Franklin would be at the top of the [British] no-fly list if he were alive today.
French and American, not so much. United States didn't exist until after he was a dissident, and most Americans would give him a pass on that remark. Besides, how are you going to look him up if he had not been allowed to return back and "discover electricity"? Archibald Spencer might disagree with that so called "discovery" thing, since he had been lecturing on the subject since '43.
Re:I always remind this sentence... (Score:4, Insightful)
Re: (Score:1)
Re: (Score:1)
No, he was stating that everyone needs guns. Read the fucking original source. The choices were between having the governor (not an elected governor, this was pre-revolution) handle Indian incursions (possibly ineffectively) by giving him more army, the temporary surrendering of liberty for safety, or by distributing arms to irregulars who were defending their land and lives.
Comment removed (Score:4, Interesting)
Re:painfullpy lacking on details (Score:5, Informative)
the article outlines the general process of how a phone is intercepted and the software is applied, but it obviously does not go into details of how the data is found or transferred. my guess is these portable tablets cellbrite has developed contain ADB and developer tools to pull off what to a seasoned slashdotter is just a parlor trick, but to a police department is nothing short of magical CSI hacking. as hackers ourselves we need to ask more questions. what is the inner machination of this tablet? how do we defeat it? can it defeat password encryption? how about Signals password-based authentication? Is there a means by which contact lists can be hardened and encrypted? All of these questions are crucial in the next 10 years as most law enforcement does not bother with a warrant when theyre halfway through your roadsite fishing expedition.
As I understand it, from what I've read, the software essentially does an unencrypted backup of the phone and then analyzes the data to produce the report. It also appears to only work on older iPhones that do not require a pass code to backup; thus rendering it useless on newer models.
Re:painfullpy lacking on details (Score:5, Informative)
the article outlines the general process of how a phone is intercepted and the software is applied, but it obviously does not go into details of how the data is found or transferred. my guess is these portable tablets cellbrite has developed contain ADB and developer tools to pull off what to a seasoned slashdotter is just a parlor trick, but to a police department is nothing short of magical CSI hacking.
as hackers ourselves we need to ask more questions. what is the inner machination of this tablet? how do we defeat it? can it defeat password encryption? how about Signals password-based authentication? Is there a means by which contact lists can be hardened and encrypted? All of these questions are crucial in the next 10 years as most law enforcement does not bother with a warrant when theyre halfway through your roadsite fishing expedition.
As I understand it, from what I've read, the software essentially does an unencrypted backup of the phone and then analyzes the data to produce the report. It also appears to only work on older iPhones that do not require a pass code to backup; thus rendering it useless on newer models.
You hit the nail on the head.
(Love your account name, by the way...epic!)
For one thing, there was no passcode on the device. That's the reason for no encryption...all iPhones of this generation were encrypted so that you couldn't pull the data directly from memory storage. But since the phone was never locked, it was trivial to simply ask the phone to divulge all of its contents as a backup, which it did. No hacking, no exploitation...just like opening a shoebox to see what's inside.
For another, you're right in that later models (if locked) would be harder to get into. Starting with one model later...the iPhone 5s...iPhones have had a separate trusted module known as "Secure Enclave." Basically, Secure Enclave is the vault that stores all the cryptographic material. The iPhone puts the keys to all of its eggs in that one basket, and then secures the bejezus out of that basket. The 5s has the A7 processor...and the A7 was the first processor to use Secure Enclave. The iPhone 5 has the A6.
Re: (Score:1)
Is it possible? (Score:2)